Penetration testing guides
Practical guides on planning a pentest, web and API testing, SaaS isolation, compliance evidence and reading a pentest report, from Excession Labs.
Written for founders, engineering leads and security teams who need to plan a test, prepare for one, or act on a report. Each guide shows real request examples, checklists or requirement text with sources.
After the pentest
After the pentest: remediation, retest and close-outWhat to do after a penetration test: triage findings, assign fixes, verify them, request a retest and close out with evidence. Includes a tracker template.How to read a penetration testing report, section by sectionHow to read a penetration testing report section by section: the 13 parts, an annotated sample finding, severity versus priority, and how to plan fixes.
Web application testing
Authentication testing checklist: login, reset, MFA, sessions and OAuthAn authentication testing checklist for web apps and APIs: login, password reset, MFA, sessions, OAuth and account enumeration, with proof and fixes.Business logic vulnerabilities: examples, testing and fixesWhat business logic vulnerabilities are, why scanners miss them, examples in pricing, workflows and limits, how testers prove them and how to fix them.CSRF testing: how pentesters check tokens, SameSite and login CSRFHow to test CSRF protection: an 8-step method, a test-case table for tokens, Origin and SameSite, JSON endpoints, login CSRF, and proof in a real browser.OWASP Top 10 2025: the list and what pentesters check for each itemOWASP Top 10:2025 with exact IDs, a one-line meaning for each category, a 2021 to 2025 mapping table and the checks a penetration tester runs.Rate limiting and credential stuffing: how to test safelyCredential stuffing testing and rate limit tests done safely: OWASP OAT-008, a bounded test design, test cases for login, reset and MFA, and how to fix gaps.
Pentest basics
Black box vs grey box vs white box penetration testingHow black box, grey box and white box penetration tests differ, what each costs you in time and depth, and a decision table to choose one.Red team vs penetration testing: what is the difference?Red team vs pentest: how the two differ in goal, scope, stealth and who knows, with an 11-row comparison table and a decision table for choosing one.What is penetration testing? A plain guide for software teamsWhat is penetration testing? What a pentest produces, the main types, how it differs from a vulnerability scan, five phases and one worked example finding.
Platform security
Bubble app security: privacy rules, Data API and workflow API checklistHow to check your own Bubble app: privacy rules on every data type, Data API and Workflow API settings, search exposure and client-side data, with a test checklist.Firebase security rules testing: Firestore, Storage and the emulatorFirebase security rules testing for Firestore, Storage and Realtime Database: working unit tests for the Local Emulator Suite, safe example rules, and a checklist.Supabase security audit: RLS, API keys, storage and RPC checklistSupabase security audit for your own project: an 8-step checklist for RLS, publishable and secret keys, views, storage and RPC, with example policies.
Compliance and evidence
Does SOC 2 require penetration testing?Does SOC 2 require penetration testing? No. See the AICPA CC4.1 wording, why auditors still ask for a pentest report, and five questions to settle first.HIPAA penetration testing: what the Security Rule says today and what HHS proposedHIPAA penetration testing requirements as of November 2026: the Security Rule in force does not name a pentest, and the January 2025 HHS proposal is not final.ISO 27001 penetration testing: what the standard asks and auditors checkISO 27001 penetration testing requirements: the standard does not name a pentest. See Annex A 8.8, 8.29 and 8.34, an evidence pack, and what to ask your auditor.PCI DSS penetration testing requirements: Requirement 11.4 explainedPCI DSS penetration testing requirements 11.4.1 to 11.4.7 (v4.0.1) in one table: test frequency, who may test, segmentation, and questions for your QSA.Pentest attestation letter: what it contains and what it cannot provePentest attestation letter: what it contains, a letter outline you can adapt, how it differs from a full report, and what no letter can prove to a buyer.Security questionnaire pentest questions: what buyers ask and how to answerPentest questions in security questionnaires (SIG, CAIQ, custom): 14 common questions with honest answer patterns, the evidence to attach, and what to avoid.
Planning a pentest
How often should you pentest? Standards, triggers and a scheduleHow often should you pentest? The PCI DSS 11.4 wording, SOC 2 and ISO 27001 position, ten changes that should trigger a test, and a schedule table by profile.How to prepare for a penetration test: a checklistHow to prepare for a penetration test: write the scope, create test accounts, load test data, pick an environment, name contacts and set a freeze window.Penetration testing rules of engagement: what to agree in writingPentest rules of engagement: what to agree in writing (authorization, scope, test windows, off-limits actions, stop conditions, data) plus a template outline.
API testing
IDOR testing: how pentesters find broken object-level authorizationIDOR testing step by step: prove it with two accounts and a read-back, use a 7-case test table and demo requests, and fix BOLA with a server-side check.OWASP API Security Top 10 (2023): the list and how to test each riskThe OWASP API Security Top 10 2023 list with exact IDs from API1 to API10, plus test ideas, sample requests, a test-case table and the usual fix for each risk.
SaaS testing
Judge us by the report
Every finding comes with the request, the response, the impact and a fix. See the demonstration report.